Our work:  We propose MultiGuard, the first provably robust defense against adversarial examples for multi-label classification. MultiGuard leverages randomized smoothing [1]}, [2]}, [3]}, [4]}, [5]}, which is the state-of-the-art technique to build provably robust classifiers. In particular, compared to other provably robust techniques, randomized smoothing has two advantages: 1) scalable to large-scale neural networks, and 2) applicable to any classifiers.
Suppose we have an arbitrary multi-label classifier (we call it base multi-label classifier), which predicts \(k^{\prime }\)  labels for an input. We build a smoothed multi-label classifier via randomizing an input. Specifically,
given an input, we first create a randomized input via adding random noise to it. We consider the random noise to be isotropic Gaussian in this work. Then, we use the base multi-label classifier to predict labels for the randomized input. Due to the randomness in the randomized input, the \(k^{\prime }\)  labels predicted by the base multi-label classifier are also random. We use \(p_i\)  to denote the probability that the label \(i\)  is among the set of \(k^{\prime }\)  labels predicted by the base multi-label classifier for the randomized input, where \(i \in \lbrace 1,2,\cdots ,c\rbrace \) . We call \(p_i\)  label probability. Our smoothed multi-label classifier predicts the \(k\)  labels with the largest label probabilities for the input. We note that \(k^{\prime }\)  and \(k\)  are two different parameters.
